@sapiom/harness 0.0.0 → 0.1.1

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,mBAAmB,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+/**
+ * @sapiom/harness — library entry. The CLI (`sapiom-harness`) is the primary
+ * interface; this export exists so other packages can reuse the contract.
+ */
+export * from "./shared/types.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,mBAAmB,CAAC"}

package/dist/profiles/canvas-guidelines.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Canvas style contract: injected everywhere an agent is asked to write to
+ * `.sapiom/canvas/index.html` (the Visualize macro's inject text, and the
+ * system prompt's canvas paragraph for freeform "show me X" asks), so every
+ * generated canvas looks Sapiom-native regardless of which prompt triggered
+ * it. Kept prompt-sized on purpose — this rides in prompts, not docs.
+ *
+ * Colors are the harness's own dark-theme tokens (web/src/styles.css,
+ * `[data-theme="dark"]`) — dark is the canonical canvas look. Structural
+ * conventions (rounded nodes with a uniform glow, straight-then-curved
+ * arrowed edges, stats header, legend footer) mirror what
+ * scripts/seed-example.mjs's reference canvas already renders; this doesn't
+ * change that seed, just documents its pattern for agents generating new
+ * ones. Edge/glow/legend wording tightened after a live Visualize proof
+ * (see PR history) surfaced ambiguities two different agent runs resolved
+ * inconsistently — see git blame for the before/after if the wording here
+ * ever seems oddly specific.
+ */
+export declare const CANVAS_STYLE_GUIDELINES: string;
+//# sourceMappingURL=canvas-guidelines.d.ts.map

package/dist/profiles/canvas-guidelines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canvas-guidelines.d.ts","sourceRoot":"","sources":["../../src/profiles/canvas-guidelines.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,uBAAuB,QA4B5B,CAAC"}

package/dist/profiles/canvas-guidelines.js

@@ -0,0 +1,48 @@
+/**
+ * Canvas style contract: injected everywhere an agent is asked to write to
+ * `.sapiom/canvas/index.html` (the Visualize macro's inject text, and the
+ * system prompt's canvas paragraph for freeform "show me X" asks), so every
+ * generated canvas looks Sapiom-native regardless of which prompt triggered
+ * it. Kept prompt-sized on purpose — this rides in prompts, not docs.
+ *
+ * Colors are the harness's own dark-theme tokens (web/src/styles.css,
+ * `[data-theme="dark"]`) — dark is the canonical canvas look. Structural
+ * conventions (rounded nodes with a uniform glow, straight-then-curved
+ * arrowed edges, stats header, legend footer) mirror what
+ * scripts/seed-example.mjs's reference canvas already renders; this doesn't
+ * change that seed, just documents its pattern for agents generating new
+ * ones. Edge/glow/legend wording tightened after a live Visualize proof
+ * (see PR history) surfaced ambiguities two different agent runs resolved
+ * inconsistently — see git blame for the before/after if the wording here
+ * ever seems oddly specific.
+ */
+export const CANVAS_STYLE_GUIDELINES = `
+Canvas style contract (.sapiom/canvas/index.html):
+- One self-contained HTML file: inline all CSS/JS, no external stylesheets/
+  scripts or CDN fonts (the CSP blocks them) — no build step, no dependencies.
+- Dark theme, Sapiom palette: background #0f0f0f, panel #1a1a1a, border
+  #2e2e2e, text #fafafa, dim text #a1a1aa, accent/success #6be195, escalation
+  #f59e0b, failure #f87171.
+- Monospace throughout: ui-monospace, "SF Mono", Menlo, Consolas, monospace.
+- Header: title + short status badge, one-line subtitle, and a stats row
+  (e.g. step count, terminal-outcome count, branch count) as label/value pairs.
+- Render the workflow as an inline SVG graph, top-to-bottom: rounded-rect
+  nodes (12-16px radius). Every node gets the same subtle glow on its
+  border — never reserve the glow for entry/terminal nodes only; role and
+  outcome are conveyed by border/stroke color, not by which nodes glow.
+- Edges: straight lines with arrowhead markers for a single-successor step,
+  curved paths with arrowhead markers only where a step branches into
+  multiple successors — don't curve every edge, that reads as noise on a
+  simple linear chain.
+- Color-code terminal outcomes by meaning: accent/green = success, amber =
+  escalation/needs-attention, red = failure. Reserve those colors for actual
+  terminal branches, not regular steps.
+- Footer legend: one visually distinct marker per node kind used (shape
+  and/or fill vs. outline — never reuse the identical marker for two
+  different kinds just because they happen to share a color) + label, plus
+  a short note that this is a static preview to regenerate after the
+  workflow changes.
+- Prefer clarity over decoration: no motion, gradients, or ornamentation that
+  doesn't help someone understand the graph's structure in a few seconds.
+`.trim();
+//# sourceMappingURL=canvas-guidelines.js.map

package/dist/profiles/canvas-guidelines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canvas-guidelines.js","sourceRoot":"","sources":["../../src/profiles/canvas-guidelines.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BtC,CAAC,IAAI,EAAE,CAAC"}

package/dist/profiles/default.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Default system prompt, appended to the coding agent's own instructions via
+ * `--append-system-prompt`. Orients a fresh session to the Sapiom-specific
+ * conventions the harness adds on top of a stock coding agent. Written to be
+ * assertive, not just informative — first-user feedback showed the prompt
+ * was being injected (confirmed via ps) but behaviorally invisible, so the
+ * closing line asks for one visible signal that it actually loaded.
+ */
+export declare const DEFAULT_SYSTEM_PROMPT: string;
+//# sourceMappingURL=default.d.ts.map

package/dist/profiles/default.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default.d.ts","sourceRoot":"","sources":["../../src/profiles/default.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,QA2D1B,CAAC"}

package/dist/profiles/default.js

@@ -0,0 +1,70 @@
+import { CANVAS_STYLE_GUIDELINES } from "./canvas-guidelines.js";
+/**
+ * Default system prompt, appended to the coding agent's own instructions via
+ * `--append-system-prompt`. Orients a fresh session to the Sapiom-specific
+ * conventions the harness adds on top of a stock coding agent. Written to be
+ * assertive, not just informative — first-user feedback showed the prompt
+ * was being injected (confirmed via ps) but behaviorally invisible, so the
+ * closing line asks for one visible signal that it actually loaded.
+ */
+export const DEFAULT_SYSTEM_PROMPT = `
+You are running in the Sapiom Harness. This is not a stock coding session —
+you have two Sapiom MCP servers pre-wired, and the conventions below are
+active for the whole session. Follow them.
+
+**The two MCPs, and when to use each:**
+- **sapiom** (remote, HTTP) — the paid capability surface an agent calls at
+  *runtime* from inside a deployed agent's step code (ctx.sapiom.*):
+  repositories, sandboxes, models, and so on. You don't call this directly
+  while authoring.
+- **sapiom-dev** (local, stdio) — the unmetered authoring surface for this
+  session. Use its sapiom_dev_agents_* tools to scaffold, validate, and ship
+  agents, and sapiom_authenticate / sapiom_status if you need to sign in.
+
+**The authoring loop, in order:** scaffold a new agent project → check
+(bundle + manifest + step-graph validation, offline) → run_local (your real
+step code against stub capabilities, no cost) → link (associate the project
+with a hosted agent) → deploy (push, build, go live). Read a project's
+AGENTS.md before touching its steps — it documents that project's specifics.
+
+**Canvas convention:** \`.sapiom/canvas/\` already has a prebuilt
+\`_template.html\` (pristine, styles and markup patterns baked in — never
+edit this one) and a live \`index.html\` cloned from it (the harness watches
+this file and renders it live in the app's canvas pane). For "visualize this
+workflow" / "how does everything connect" asks (including the Visualize
+action), clone \`_template.html\` over \`index.html\` and fill in the content
+using the node/edge/stats/legend markup patterns documented in the
+template's own \`<template id="canvas-patterns">\` block — keep the
+\`<style>\` block and structural classes untouched, write no new CSS. Only
+write a full replacement file from scratch, ignoring the template, when
+someone asks for a genuinely custom canvas its patterns can't represent; in
+that case follow this style contract so it still looks Sapiom-native:
+${CANVAS_STYLE_GUIDELINES}
+
+**Your current workspace state:** the harness mirrors what it knows about
+this workspace at \`.sapiom/harness-context.json\`, relative to your working
+directory (\`{"boundWorkflow": {name, path, definitionId} | null,
+"workflows": [{name, path, definitionId}, ...], "session": {id, cwd,
+harness}, "updatedAt": ...}\`). \`boundWorkflow\` is whichever workflow the
+person currently has selected in the app, or \`null\` if none;
+\`workflows\` is every workflow the app has discovered here, selected or
+not. Read it when they say "this workflow," ask what they're working on, or
+ask what workflows exist — both fields can change mid-session (a new
+selection, a newly scanned/connected project), so re-read the file rather
+than assuming it's still what it was earlier in the conversation.
+
+**In your very first reply this session**, orient the person before you get
+to their actual request — briefly, 2-4 sentences total, not a lecture:
+1. Acknowledge that you're running in the Sapiom Harness with these MCPs
+   available (one line), so they can see this loaded.
+2. Say what you can do for them here: visualize a workflow on the canvas
+   pane, run it locally against stub capabilities at no cost, and deploy it
+   live — all also one click away via the action buttons next to each
+   workflow, or ⌘K.
+3. Suggest ONE concrete first step, picked from the workspace state file
+   above: if a workflow is bound or listed (e.g. the bundled order-triage
+   sample project), offer to visualize or run that one by name; if none
+   exists yet, offer to scaffold a new agent project. Phrase it as an
+   invitation ("want me to…?"), then stop — don't act on it unprompted.
+`.trim();
+//# sourceMappingURL=default.js.map

package/dist/profiles/default.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default.js","sourceRoot":"","sources":["../../src/profiles/default.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgCnC,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BxB,CAAC,IAAI,EAAE,CAAC"}

package/dist/server/auth.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Boot-token auth: every /api request (X-Harness-Token header) and every WS
+ * upgrade (token query param) is checked against the same per-boot secret.
+ */
+import type { RequestHandler } from "express";
+/** Constant-time string comparison — avoids leaking token length/prefix via timing. */
+export declare function timingSafeEqualString(a: string, b: string): boolean;
+export declare function createBootTokenMiddleware(bootToken: string): RequestHandler;
+//# sourceMappingURL=auth.d.ts.map

package/dist/server/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAyB,cAAc,EAAY,MAAM,SAAS,CAAC;AAE/E,uFAAuF;AACvF,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAUnE;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,CAS3E"}

package/dist/server/auth.js

@@ -0,0 +1,28 @@
+/**
+ * Boot-token auth: every /api request (X-Harness-Token header) and every WS
+ * upgrade (token query param) is checked against the same per-boot secret.
+ */
+import { timingSafeEqual } from "node:crypto";
+/** Constant-time string comparison — avoids leaking token length/prefix via timing. */
+export function timingSafeEqualString(a, b) {
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    if (bufA.length !== bufB.length) {
+        // Compare something of equal length anyway so this branch doesn't
+        // resolve measurably faster than a real (mismatched-content) comparison.
+        timingSafeEqual(bufA, bufA);
+        return false;
+    }
+    return timingSafeEqual(bufA, bufB);
+}
+export function createBootTokenMiddleware(bootToken) {
+    return (req, res, next) => {
+        const provided = req.header("X-Harness-Token") ?? "";
+        if (!timingSafeEqualString(provided, bootToken)) {
+            res.status(401).json({ error: "unauthorized" });
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/server/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,uFAAuF;AACvF,MAAM,UAAU,qBAAqB,CAAC,CAAS,EAAE,CAAS;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,kEAAkE;QAClE,yEAAyE;QACzE,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/canvas-render.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `POST /api/canvas/:sessionId/render` — the deterministic, zero-LLM render
+ * trigger. Mounted under the same `/api` boot-token middleware as the rest of
+ * the REST surface (see server/index.ts). Renders the session's bound
+ * workflow to its per-workflow render file (a cheap no-op when unbound);
+ * writing the file is enough to hot-reload an already-open canvas pane
+ * (CanvasWatcherManager picks up the change on its own).
+ */
+import { type Router as ExpressRouter } from "express";
+import { type RenderableSession, type RenderableWorkflow } from "../core/canvas-render.js";
+export interface CanvasRenderRouterDeps {
+    /** Look up a session's cwd + current binding; undefined when unknown. */
+    getSession(harnessSessionId: string): RenderableSession | undefined;
+    /** The live workflow registry snapshot. */
+    listWorkflows(): RenderableWorkflow[];
+}
+export declare function createCanvasRenderRouter(deps: CanvasRenderRouterDeps): ExpressRouter;
+//# sourceMappingURL=canvas-render.d.ts.map

package/dist/server/canvas-render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canvas-render.d.ts","sourceRoot":"","sources":["../../src/server/canvas-render.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAU,KAAK,MAAM,IAAI,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAA0B,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnH,MAAM,WAAW,sBAAsB;IACrC,yEAAyE;IACzE,UAAU,CAAC,gBAAgB,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC;IACpE,2CAA2C;IAC3C,aAAa,IAAI,kBAAkB,EAAE,CAAC;CACvC;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,sBAAsB,GAAG,aAAa,CAcpF"}

package/dist/server/canvas-render.js

@@ -0,0 +1,24 @@
+/**
+ * `POST /api/canvas/:sessionId/render` — the deterministic, zero-LLM render
+ * trigger. Mounted under the same `/api` boot-token middleware as the rest of
+ * the REST surface (see server/index.ts). Renders the session's bound
+ * workflow to its per-workflow render file (a cheap no-op when unbound);
+ * writing the file is enough to hot-reload an already-open canvas pane
+ * (CanvasWatcherManager picks up the change on its own).
+ */
+import { Router } from "express";
+import { renderCanvasForSession } from "../core/canvas-render.js";
+export function createCanvasRenderRouter(deps) {
+    const router = Router();
+    router.post("/canvas/:sessionId/render", async (req, res) => {
+        const session = deps.getSession(req.params.sessionId);
+        if (!session) {
+            res.status(404).json({ error: `Unknown session '${req.params.sessionId}'` });
+            return;
+        }
+        const outcome = await renderCanvasForSession(session, deps.listWorkflows());
+        res.json({ ok: true, ...outcome });
+    });
+    return router;
+}
+//# sourceMappingURL=canvas-render.js.map

package/dist/server/canvas-render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canvas-render.js","sourceRoot":"","sources":["../../src/server/canvas-render.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,EAAgC,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAmD,MAAM,0BAA0B,CAAC;AASnH,MAAM,UAAU,wBAAwB,CAAC,IAA4B;IACnE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,GAAG,CAAC,MAAM,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/canvas.d.ts

@@ -0,0 +1,12 @@
+import { type Router as ExpressRouter } from "express";
+export interface CanvasSession {
+    cwd: string;
+    /** The workflow the session is bound to, if any — decides what the canvas
+     *  root request serves (the workflow's render vs. the legacy index.html). */
+    boundWorkflowPath?: string | null;
+}
+/** Looks up a session by harnessSessionId; undefined when unknown (the real
+ *  implementation is the SessionManager, once workstream W1 lands). */
+export type CanvasSessionLookup = (harnessSessionId: string) => CanvasSession | undefined;
+export declare function createCanvasRouter(getSession: CanvasSessionLookup): ExpressRouter;
+//# sourceMappingURL=canvas.d.ts.map

package/dist/server/canvas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canvas.d.ts","sourceRoot":"","sources":["../../src/server/canvas.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAU,KAAK,MAAM,IAAI,aAAa,EAA+B,MAAM,SAAS,CAAC;AAkE5F,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ;iFAC6E;IAC7E,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED;uEACuE;AACvE,MAAM,MAAM,mBAAmB,GAAG,CAAC,gBAAgB,EAAE,MAAM,KAAK,aAAa,GAAG,SAAS,CAAC;AAwF1F,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,mBAAmB,GAAG,aAAa,CAejF"}

package/dist/server/canvas.js

@@ -0,0 +1,174 @@
+/**
+ * Canvas serving (workstream W5's backend slice).
+ *
+ * Serves files under `<cwd>/.sapiom/canvas/` (see CANVAS_DIR) at
+ * `GET /canvas/:harnessSessionId/*`. The root request resolves by binding:
+ * a session bound to a workflow gets that workflow's deterministic render
+ * (`renders/<slug>.html` — resolved at request time, so switching the
+ * binding is instant, no file rewrite involved); an unbound session gets its
+ * agent-authored `index.html` custom canvas — but ONLY when the file is a
+ * genuine custom canvas. A machine-generated `index.html` (the seeded
+ * template, or a stale legacy deterministic overview a pre-split server wrote
+ * there) is NOT served: the unbound session gets the clean empty state
+ * instead, so it never opens to a wall of unrelated "render failed" panels
+ * (see core/canvas-index-classify.ts). The SPA's CanvasPane embeds this in a sandboxed iframe
+ * and probes it with a HEAD request (`fetch('/canvas/<id>/', { method:
+ * 'HEAD' })`), so this stays intentionally simple and unauthenticated — the
+ * server binds 127.0.0.1 only, and an iframe `src` / HEAD probe can't carry
+ * the boot token anyway. The integrator mounts this alongside the
+ * SessionManager.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { Router } from "express";
+import { CANVAS_DIR, CANVAS_INDEX } from "../shared/types.js";
+import { slugForWorkflowPath } from "../core/canvas-render.js";
+import { isMachineGeneratedCanvas } from "../core/canvas-index-classify.js";
+import { resolveWithinRoot } from "../core/path-safety.js";
+const INDEX_FILENAME = path.basename(CANVAS_INDEX);
+const MIME_TYPES = {
+    ".html": "text/html; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".mjs": "text/javascript; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".ico": "image/x-icon",
+    ".txt": "text/plain; charset=utf-8",
+};
+function contentTypeFor(filePath) {
+    return MIME_TYPES[path.extname(filePath).toLowerCase()] ?? "application/octet-stream";
+}
+// Agent-generated HTML is expected to be self-contained (inline <script>/<style>,
+// no build step — see the canvas convention), so this can't be a locked-down
+// "no inline" policy. It still meaningfully narrows what that content can do:
+// no plugins, no fetch-y content types, and it can only be framed by the
+// harness's own origin (the SPA embeds it same-origin, in a sandboxed iframe
+// with no allow-same-origin — this is defense in depth on top of that, not a
+// replacement for it).
+const CANVAS_CSP = "default-src 'self' data: blob:; script-src 'self' 'unsafe-inline'; " +
+    "style-src 'self' 'unsafe-inline'; img-src * data: blob:; connect-src *; " +
+    "object-src 'none'; frame-ancestors 'self'";
+const EMPTY_STATE_HTML = `<!doctype html>
+<html>
+<head><meta charset="utf-8"><title>Canvas — nothing here yet</title></head>
+<body style="font-family: system-ui, sans-serif; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0; color: #444; text-align: center; padding: 0 2rem;">
+  <div>
+    <h1 style="font-size: 1.1rem; margin-bottom: 0.5rem;">Nothing rendered yet</h1>
+    <p style="margin: 0;">Select a workflow in the rail to visualize it, or ask your agent to write HTML to
+    <code>.sapiom/canvas/index.html</code> in this project — this pane hot-reloads whenever it changes.</p>
+  </div>
+</body>
+</html>`;
+/** Served for a BOUND session whose render file hasn't been written yet
+ *  (render in flight, or a server restart before any re-render). The pane
+ *  hot-reloads the moment the render lands, so this is only ever briefly
+ *  visible. */
+const PENDING_RENDER_HTML = `<!doctype html>
+<html>
+<head><meta charset="utf-8"><title>Canvas — rendering</title></head>
+<body style="font-family: system-ui, sans-serif; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0; color: #444; text-align: center; padding: 0 2rem;">
+  <div>
+    <h1 style="font-size: 1.1rem; margin-bottom: 0.5rem;">Rendering workflow diagram…</h1>
+    <p style="margin: 0;">This pane reloads automatically when the diagram is ready.</p>
+  </div>
+</body>
+</html>`;
+/** `relative === null` means "the canvas root" — what it resolves to depends
+ *  on the session's current binding, decided per request so switching the
+ *  bound workflow needs no file rewrite at all. */
+function serveCanvas(getSession, req, res, relative) {
+    res.setHeader("Content-Security-Policy", CANVAS_CSP);
+    const session = getSession(req.params.harnessSessionId);
+    if (!session) {
+        res.status(404).end();
+        return;
+    }
+    const isRoot = relative === null;
+    const bound = isRoot ? (session.boundWorkflowPath ?? null) : null;
+    const resolved = isRoot
+        ? bound
+            ? path.join("renders", `${slugForWorkflowPath(bound)}.html`)
+            : INDEX_FILENAME
+        : relative;
+    // The unbound canvas root serves index.html ONLY when it's a genuine
+    // agent-authored custom canvas; a machine-generated one (seeded template or
+    // stale legacy overview) is shadowed by the empty state (see below).
+    const unboundRoot = isRoot && !bound;
+    const canvasRoot = path.resolve(session.cwd, CANVAS_DIR);
+    // Path-traversal guard, applied to the user-controlled request path
+    // (`resolved` is the `*` wildcard for a non-root request). resolveWithinRoot
+    // rejects any value — a `..` climb, an absolute path — that would resolve
+    // outside canvasRoot; a bound/index root request passes a server-built,
+    // already-safe `resolved` (a hashed slug or the index constant).
+    const filePath = resolveWithinRoot(canvasRoot, resolved);
+    if (!filePath) {
+        res.status(400).end();
+        return;
+    }
+    // A friendly explainer, served as a NON-ok 404 so the CanvasPane's HEAD
+    // probe reads "no content" and shows its own empty state rather than
+    // framing this page — while a direct browser visit still gets the hint.
+    const sendEmptyState = () => {
+        res.status(404).setHeader("Content-Type", "text/html; charset=utf-8");
+        res.end(EMPTY_STATE_HTML);
+    };
+    fs.stat(filePath, (err, stat) => {
+        if (err || !stat.isFile()) {
+            // A bound session whose render file isn't on disk yet gets the
+            // "rendering…" page — the pane hot-reloads once the render lands.
+            if (isRoot && bound) {
+                res.status(200).setHeader("Content-Type", "text/html; charset=utf-8");
+                res.end(PENDING_RENDER_HTML);
+                return;
+            }
+            // The canvas index specifically missing gets a friendly explainer
+            // (useful when this URL is opened directly, e.g. in a new tab during a
+            // demo); any other missing file (a referenced asset) stays a plain 404.
+            if (resolved === INDEX_FILENAME) {
+                sendEmptyState();
+                return;
+            }
+            res.status(404).end();
+            return;
+        }
+        // Unbound root: only serve index.html when it's a genuine custom canvas.
+        // A stale machine-generated file (seeded template, or a legacy
+        // deterministic overview a pre-split server wrote to index.html) shows the
+        // empty state instead — an unbound session must never open to a wall of
+        // unrelated "render failed" panels.
+        if (unboundRoot) {
+            fs.readFile(filePath, "utf8", (readErr, content) => {
+                if (readErr || isMachineGeneratedCanvas(content)) {
+                    sendEmptyState();
+                    return;
+                }
+                res.setHeader("Content-Type", "text/html; charset=utf-8");
+                res.setHeader("Cache-Control", "no-store");
+                res.end(content);
+            });
+            return;
+        }
+        res.setHeader("Content-Type", contentTypeFor(filePath));
+        res.setHeader("Cache-Control", "no-store");
+        fs.createReadStream(filePath).pipe(res);
+    });
+}
+export function createCanvasRouter(getSession) {
+    const router = Router();
+    router.get("/canvas/:harnessSessionId/*", (req, res) => {
+        // Express's route-param typing doesn't model the unnamed `*` wildcard —
+        // it's there at runtime as params[0], just not in the inferred type.
+        const wildcard = req.params[0];
+        serveCanvas(getSession, req, res, wildcard || null);
+    });
+    router.get(["/canvas/:harnessSessionId", "/canvas/:harnessSessionId/"], (req, res) => {
+        serveCanvas(getSession, req, res, null);
+    });
+    return router;
+}
+//# sourceMappingURL=canvas.js.map

package/dist/server/canvas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canvas.js","sourceRoot":"","sources":["../../src/server/canvas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,MAAM,EAA6D,MAAM,SAAS,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AAEnD,MAAM,UAAU,GAA2B;IACzC,OAAO,EAAE,0BAA0B;IACnC,MAAM,EAAE,yBAAyB;IACjC,KAAK,EAAE,gCAAgC;IACvC,MAAM,EAAE,gCAAgC;IACxC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,2BAA2B;CACpC,CAAC;AAEF,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,0BAA0B,CAAC;AACxF,CAAC;AAED,kFAAkF;AAClF,6EAA6E;AAC7E,8EAA8E;AAC9E,yEAAyE;AACzE,6EAA6E;AAC7E,6EAA6E;AAC7E,uBAAuB;AACvB,MAAM,UAAU,GACd,qEAAqE;IACrE,0EAA0E;IAC1E,2CAA2C,CAAC;AAE9C,MAAM,gBAAgB,GAAG;;;;;;;;;;QAUjB,CAAC;AAET;;;eAGe;AACf,MAAM,mBAAmB,GAAG;;;;;;;;;QASpB,CAAC;AAaT;;mDAEmD;AACnD,SAAS,WAAW,CAAC,UAA+B,EAAE,GAAY,EAAE,GAAa,EAAE,QAAuB;IACxG,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,UAAU,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,KAAK,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM;QACrB,CAAC,CAAC,KAAK;YACL,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;YAC5D,CAAC,CAAC,cAAc;QAClB,CAAC,CAAC,QAAQ,CAAC;IACb,qEAAqE;IACrE,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;IAErC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACzD,oEAAoE;IACpE,6EAA6E;IAC7E,0EAA0E;IAC1E,wEAAwE;IACxE,iEAAiE;IACjE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,wEAAwE;IACxE,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,cAAc,GAAG,GAAS,EAAE;QAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;QACtE,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5B,CAAC,CAAC;IAEF,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,+DAA+D;YAC/D,kEAAkE;YAClE,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;gBACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;gBACtE,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YACD,kEAAkE;YAClE,uEAAuE;YACvE,wEAAwE;YACxE,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;gBAChC,cAAc,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,yEAAyE;QACzE,+DAA+D;QAC/D,2EAA2E;QAC3E,wEAAwE;QACxE,oCAAoC;QACpC,IAAI,WAAW,EAAE,CAAC;YAChB,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;gBACjD,IAAI,OAAO,IAAI,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC;oBACjD,cAAc,EAAE,CAAC;oBACjB,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;gBAC1D,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBAC3C,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,UAA+B;IAChE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,MAAM,CAAC,GAAG,CAAC,6BAA6B,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACrD,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,QAAQ,GAAI,GAAG,CAAC,MAA4C,CAAC,CAAC,CAAC,CAAC;QACtE,WAAW,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,CAAC,2BAA2B,EAAE,4BAA4B,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnF,WAAW,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/events-ws.d.ts

@@ -0,0 +1,11 @@
+/**
+ * /ws/events?token= — server→client bus broadcasting BusMessage. Forwards
+ * whatever the shared EventBus publishes (session.status, canvas.reload,
+ * port.detected, workflows.changed) — the integrator is responsible for
+ * feeding all of those into the bus from their respective sources.
+ */
+import type { IncomingMessage } from "node:http";
+import type { WebSocket } from "ws";
+import type { EventBus } from "../core/event-bus.js";
+export declare function createEventsWebSocketHandler(bus: EventBus, bootToken: string): (ws: WebSocket, _req: IncomingMessage, params: URLSearchParams) => void;
+//# sourceMappingURL=events-ws.d.ts.map

package/dist/server/events-ws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events-ws.d.ts","sourceRoot":"","sources":["../../src/server/events-ws.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAEpC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAIrD,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,IACnE,IAAI,SAAS,EAAE,MAAM,eAAe,EAAE,QAAQ,eAAe,KAAG,IAAI,CAgB7E"}

package/dist/server/events-ws.js

@@ -0,0 +1,24 @@
+/**
+ * /ws/events?token= — server→client bus broadcasting BusMessage. Forwards
+ * whatever the shared EventBus publishes (session.status, canvas.reload,
+ * port.detected, workflows.changed) — the integrator is responsible for
+ * feeding all of those into the bus from their respective sources.
+ */
+import { timingSafeEqualString } from "./auth.js";
+export function createEventsWebSocketHandler(bus, bootToken) {
+    return (ws, _req, params) => {
+        const token = params.get("token") ?? "";
+        if (!timingSafeEqualString(token, bootToken)) {
+            ws.close(4001, "unauthorized");
+            return;
+        }
+        const send = (message) => {
+            if (ws.readyState === ws.OPEN)
+                ws.send(JSON.stringify(message));
+        };
+        const unsubscribe = bus.subscribe(send);
+        ws.on("close", unsubscribe);
+        ws.on("error", unsubscribe);
+    };
+}
+//# sourceMappingURL=events-ws.js.map

package/dist/server/events-ws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events-ws.js","sourceRoot":"","sources":["../../src/server/events-ws.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAElD,MAAM,UAAU,4BAA4B,CAAC,GAAa,EAAE,SAAiB;IAC3E,OAAO,CAAC,EAAa,EAAE,IAAqB,EAAE,MAAuB,EAAQ,EAAE;QAC7E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7C,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,OAAmB,EAAQ,EAAE;YACzC,IAAI,EAAE,CAAC,UAAU,KAAK,EAAE,CAAC,IAAI;gBAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,CAAC,CAAC;QAEF,MAAM,WAAW,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAExC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5B,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC9B,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/fs.d.ts

@@ -0,0 +1,4 @@
+import { type Router as ExpressRouter } from "express";
+export type { FsDirEntry, FsListResponse } from "../shared/types.js";
+export declare function createFsRouter(): ExpressRouter;
+//# sourceMappingURL=fs.d.ts.map

package/dist/server/fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../src/server/fs.ts"],"names":[],"mappings":"AAUA,OAAO,EAAU,KAAK,MAAM,IAAI,aAAa,EAAE,MAAM,SAAS,CAAC;AAI/D,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAUrE,wBAAgB,cAAc,IAAI,aAAa,CAyE9C"}

package/dist/server/fs.js

@@ -0,0 +1,88 @@
+/**
+ * Filesystem browsing for the SPA's path-picker autocomplete: `GET
+ * /api/fs/list?path=<abs-or-~>` → directories only, one level deep. This is
+ * a self-contained express Router with no dependency on the rest of the
+ * server — the integrator mounts it (behind the boot token, like the rest
+ * of /api) alongside everything else.
+ */
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { Router } from "express";
+import { hasTraversalSegment } from "../core/path-safety.js";
+const MAX_RESULTS = 200;
+function expandHome(input) {
+    if (input === "~")
+        return os.homedir();
+    if (input.startsWith("~/"))
+        return path.join(os.homedir(), input.slice(2));
+    return input;
+}
+export function createFsRouter() {
+    const router = Router();
+    router.get("/api/fs/list", async (req, res) => {
+        const rawPath = req.query.path;
+        if (typeof rawPath !== "string" || !rawPath.trim()) {
+            res.status(400).json({ error: "path query param is required" });
+            return;
+        }
+        const expanded = expandHome(rawPath);
+        if (!path.isAbsolute(expanded)) {
+            res.status(400).json({ error: `path must be absolute (or start with ~): ${rawPath}` });
+            return;
+        }
+        // Normalizes `..`/`.`/duplicate-slash segments; still absolute since the
+        // input already was (checked above), so this can't turn a validated
+        // absolute path into a relative one.
+        const resolved = path.resolve(expanded);
+        // This picker intentionally browses any absolute directory the user names,
+        // so there's no single root to confine to — but a fully resolved path must
+        // never retain a `..` segment. Assert that explicitly at the sink: it
+        // rejects nothing legitimate (resolve() already normalized traversal away)
+        // and makes the no-traversal guarantee local to the readdir below.
+        if (hasTraversalSegment(resolved)) {
+            res.status(400).json({ error: `path must not contain traversal segments: ${rawPath}` });
+            return;
+        }
+        const includeHidden = req.query.hidden === "1";
+        let entries;
+        try {
+            // withFileTypes uses the OS's raw dirent info (not a followed lstat/stat),
+            // so a symlink — even one pointing at a directory — reports
+            // isDirectory() === false here and is naturally excluded below rather
+            // than being traversed into.
+            entries = await fs.readdir(resolved, { withFileTypes: true });
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === "ENOENT") {
+                res.status(404).json({ error: `no such directory: ${resolved}` });
+                return;
+            }
+            if (code === "ENOTDIR") {
+                res.status(400).json({ error: `not a directory: ${resolved}` });
+                return;
+            }
+            if (code === "EACCES" || code === "EPERM") {
+                res.status(403).json({ error: `permission denied: ${resolved}` });
+                return;
+            }
+            res.status(500).json({ error: err.message });
+            return;
+        }
+        const dirs = entries
+            .filter((entry) => entry.isDirectory())
+            .filter((entry) => includeHidden || !entry.name.startsWith("."))
+            .map((entry) => ({ name: entry.name, path: path.join(resolved, entry.name) }))
+            .sort((a, b) => a.name.localeCompare(b.name))
+            .slice(0, MAX_RESULTS);
+        const response = {
+            path: resolved,
+            parent: path.dirname(resolved),
+            dirs,
+        };
+        res.json(response);
+    });
+    return router;
+}
+//# sourceMappingURL=fs.js.map